Authentication: A Guide to Strong and Secure Access Management

Worried about protecting your organization from unauthorized access? Implementing a Zero Trust architecture? No matter your goal, authentication is critical to your success.

Read on to discover the importance of strong authentication, the options at your fingertips, and how Entrust can prepare your business for the future.

The National Institute of Standards and Technology (NIST) defines authentication as a process of verifying the identity of a user, or device as a prerequisite for allowing access to resources in an information system.

More simply, it’s a way of validating that someone (or something) is who they claim to be. Therefore, authentication is a security measure designed to protect against unauthorized users or machines from accessing protected assets.

Authentication vs. authorization

The term “unauthorized access” is especially relevant when discussing authentication methods. Although closely related, the definition of “authorization” is notably different.

Specifically, authorization is the process of giving an authenticated user permission to access a specific resource or function. This is an important distinction, as not all entities that are authenticated may be authorized to use certain assets.

Let’s say an employee wants to access a particular cloud application. They’re prompted to input their authentication credentials, such as a username and password. However, their organization’s access control policies may restrict that application to only senior-level employees. In this case, because they’re not an authorized user, they’re unable to use the requested resource.

Think of authentication as the key that gets you in the door, but authorization as the badge that allows you to enter certain areas of the building. Anyone with a key can enter the premises, but unauthorized users can’t access the VIP lounge. So, in summary, here’s the difference:

• Authentication confirms identity.
• Authorization confirms permission.

In combination, both processes are essential components of cybersecurity and access management.

Digital authentication began in the 1960s. At the time, computers were massive room-sized devices that you could only find at large research institutes and universities. Because of their size, they were shared by students, staff, and researchers alike.

The only problem? Everyone had unfettered access to one another’s files. Recognizing this issue, an MIT student created a basic password program — and with that, digital authentication was born.

Decades later, authentication methods have evolved with the times, but the premise is the same: Provide users safe and secure access to the resources they rely on. Only now, given our digital age, strong authentication is more important than ever before.

Without a proper authentication system in place, threat actors may gain unauthorized access to private and corporate accounts. Worse yet, it takes just one breached credential to spiral into a full-fledged attack against all connected accounts, compromising sensitive data at scale.

Fortunately, new and improved approaches to cybersecurity are introducing innovative ways to handle these types of threats — namely, the Zero Trust framework. This model not only advocates against implicit trust, but also places authentication at the heart of its architecture.

Authentication and Zero Trust

In short, Zero Trust security is a framework that assumes all entities are potentially malicious and should be treated as such. Rather than verify identity just once, it aims to continuously authenticate users every time they request access to any resource, including networks, applications, files, and more.

This approach is especially significant for two reasons:

1. Cybercrime: Hackers are constantly targeting privileged accounts, exploiting weak passwords, deploying ransomware, and harvesting sensitive data in the process. According to Verizon’s 2023 report, roughly half of all external breaches are caused by credential theft. In fact, 90% of surveyed organizations experienced a phishing attack in 2020, while another 29% reported credential stuffing and brute force attacks, which resulted in many password resets.
2. Machine identities: Did you know most enterprises have more connected devices than they do human users? These “machines” — servers, computers, and so on — are authenticated using digital certificates and cryptographic keys called “machine identities.” But, in the wrong hands, these credentials can devastate security. Globally, unprotected machine identities cost the world over $51 billion in economic losses. That’s why organizations must constantly validate a machine’s identity matches that stored in their database.

Luckily, these problems are exactly what a Zero Trust architecture solves. And, with authentication a central tenet of its model, enterprises can create a firm foundation for their framework by implementing a continuous authentication mechanism throughout their entire environment.

Authentication use cases

Now that more organizations have a better understanding of access control, they’re starting to leverage digital authentication in new and exciting ways. Some of the most common enterprise use cases include:

1. Logging in to corporate resources: Continuous authentication tools allow employees to access key company systems. From email and documents to databases and cloud services, this ensures sensitive corporate data remains under lock and key.
2. Online banking and financial services: Strong authentication is essential to customer onboarding and online banking. Not only does it verify someone’s identity when they open a new account or access an existing one, but it does so without severely impacting the user experience.
3. Providing secure remote access: Authentication is especially vital in the hybrid work era. Employees are working all across the globe using unprotected devices and unsecured networks, making it all the more important to verify user and machine identity.
4. Protecting digital transactions: E-commerce moves at the speed of light, but some organizations struggle to maintain pace. But, with an innovative authentication scheme, you can protect financial data and sensitive information while fighting fraud and improving customer trust.
5. Improving machine identity management: Despite being outnumbered, enterprises can take back control of their machine identities by leveraging continuous authentication. This protects cryptographic assets throughout their lifecycle, ensuring secure connections between machines.

A user or entity provides credentials, which are compared against those on file in a database of authorized information. This record may be located on-premises in a local operating server or a cloud-based authentication server.

Notably, these credentials may not just be a simple username and password combination but a series of identifying attributes that work in harmony to validate the requesting individual. Ultimately, this depends on the particular authentication method. Biometric authentication, for example, may use facial recognition or fingerprinting.

If the provided information matches what’s on file, the system may authorize the entity to use the resource, which provides access to the end user. However, this also depends on other conditions, such as pre-determined access control policies — known as “permissions.”

In other words, even if a user submits the correct credentials, they won’t be authorized if they’re not granted access rights for the resource in question.

Of course, you might be wondering: How long does this process take? Although it may seem complex and burdensome, it actually happens within seconds. With a fast and robust authentication scheme, you can verify identity without hindering the user experience.

What are authentication factors?

At its most basic, an authentication factor represents a piece of information or an attribute that can validate a user or entity requesting access to any given resource. Traditionally, authentication factors can be something you know, something you have, or something you are. However, two additional variables have emerged over the years, bringing the total to five.

Therefore, the following are used to authenticate identity:

1. Knowledge factor: Any credential reflecting information the user knows, such as a personal identification number (PIN) or password.
2. Possession factor: This includes any credential the user owns, like a token or smart card.
3. Inherence factor: As something you are, inherence factors include biometric data like thumbprints or retina scans.
4. Location factor: This factor is especially relevant to devices. Let’s say someone normally logs in from home, but one day their account becomes active in a foreign country. Geographic data allows you to prevent attackers in remote locations from accessing resources through compromised accounts.
5. Time factor: Time is used in coordination with other factors. It proves an individual’s identity simply by checking it within a scheduled time interval and in relation to a designated location, such as an employee’s home or office.

Although the first three can authenticate identity on their own, the last two must be used alongside one of the others to sufficiently verify an individual or machine.

Which authentication method is best for your business? Trick question: There’s probably not just one solution. It’s better to ensure you’re fully protected with a layered and robust authentication system, complete with many different methods.

Let’s review some of the most essential types of authentication and how they work:

1. Single-factor authentication (1FA)

1FA is one of the most basic authentication types. In simple terms, 1FA is exactly as it sounds: a system that only requires one of three core authentication factors.

Take password authentication, for example. Under this method, an individual provides a username and password (or PIN). This is by far the most common authentication tactic, but also the easiest to exploit.

Unfortunately, people tend to use weak passwords. Even worse, they reuse the same ones for multiple accounts, leaving them vulnerable to social engineering threats, such as a phishing attack.

2. Multi-factor authentication (MFA)

MFA requires more than one authentication factor to verify someone’s identity. By definition, two-factor authentication (2FA) would fall under this category, but MFA is generally considered a safer option.

In this case, individuals must submit other information in addition to their password, such as a one-time verification code. They may also be asked to answer a personal security question that only they would know the answer to.

MFA helps organizations thwart phishing attacks and other malicious threats by creating more layers of protection than basic authentication.

3. Single sign-on (SSO)

The SSO method allows the user to apply one unified set of credentials to multiple accounts. This process is especially popular because it simplifies the login effort and provides a faster user experience.

From a business perspective, this enables employees to quickly access connected applications by logging in just once. The system issues a digital certificate, which is checked every time the user requests access to an SSO-integrated application.

However, if hackers obtain SSO credentials, they also gain access to that user’s connected applications. So, this method is best supported by additional authentication tactics.

4. Passwordless authentication

A passwordless authentication system, as the name implies, doesn't require you to enter a static password. Instead, it identifies the user through other means. This can include biometrics and hardware tokens, but most commonly leverages a one-time passcode (OTP).

OTPs, sometimes referred to as time-based one-time passwords (TBOTPs), provide a more secure authentication process because they generate temporary credentials on an as-needed basis. For example, when someone logs in to an application, they may be sent a passcode to their email and/or mobile device. Providing this code allows them access to the resource.

5. Biometric authentication

Rather than rely on credentials that can be stolen, biometric identifiers are unique to the individual. Common types of biometric factors include:

• Fingerprints
• Palm scans
• Facial recognition
• Iris recognition

6. Certificate-based authentication (CBA)

CBA uses digital certificates to verify an entity’s identity and grant it access to a computer system.

Using public-key cryptography, certificates provide a unique code that includes information about the user and/or device. They also include cryptographic keys that establish a secure connection with the requested resource.

CBA is often used in highly sensitive situations where the utmost assurance is required.

7. Token-based authentication (TBA)

TBA is an authentication protocol that generates unique, encrypted security tokens. During the lifespan of the token, which can be revoked or renewed, users can access any website or application the token has been issued for rather than having to re-enter their credentials every time they return.

8. Risk-based adaptive authentication

Risk-based authentication (RBA), also called adaptive authentication, dynamically changes based on the level of risk associated with each particular session or transaction. In short, it assigns a risk score to these interactions, using this to determine the amount of authentication required to prove the entity’s identity.

For instance, a low-risk session may only require two-factor authentication. But, if it’s a high-risk situation, the system may ask the user to complete additional challenges.

Strong and continuous authentication is key to modern cybersecurity. Your organization needs total assurance that its connections, identities, and data are safe from unauthorized access — and fortunately, that’s exactly what Entrust can provide.

Our identity and access management (IAM) portfolio includes all the essential tools you need to protect your enterprise at scale. From phishing-resistant MFA to adaptive step-up authentication, you can implement a layered and robust strategy in one comprehensive suite.